Panorama subtenancy support in the Unified Incident Framework introduces a tenant-aware context that filters Prisma® Access incidents, settings, and related operational data to a specific tenant. This allows you to scope security incident investigations to a specific environment without interference from unrelated tenant data.

When you first access Incidents, the web interface defaults to your top level parent tenant to provide the broadest organizational scope. The unified incident framework preserves your tenant selection as you navigate between pages. This persistent behavior means you do not need to reselect your tenant each time you move from the incident list to a settings page or return to the incident view. When you select a specific Prisma Access tenant, incidents originating from other products (such as Next-Generation Firewalls) remain visible and are unaffected by your tenant selection. You can independently apply product-level filters to further refine the displayed incidents.

Configuration settings within the Unified Incident Framework operate at the level of your selected Prisma® Access tenant. When you navigate from the Incident list to the Settings page, the framework carries your current tenant context forward and applies any configuration changes to that specific tenant. You can't apply settings across all tenants simultaneously, which ensures each tenant's configuration remains isolated.

Notification Profiles, Informational Alerts, and ServiceNow Audit Log operate at the tenant service group (TSG) level rather than the individual Prisma Access tenant level. Because these pages are not scoped to a specific Prisma Access tenant, the tenant selector does not appear on these pages.